>I don't think that's too much to ask.

You're right, thats not too much. It also isn't what we're talking about. I'm saying that full disclosure of security and privacy flaws including all detail and even exploitation code is not a good thing.